feat: Add labels for label-based metric scraping

Add prometheus.io labels to compose.metrics.yml so monitoring-ng can
auto-discover and scrape Traefik's metrics on the internal network when
enabled.

.env.sample

@@ -139,10 +139,14 @@ WRITE_TIMEOUT=0s
 #####################################################################
 
 ## Enable prometheus metrics collection
-## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
+## Metrics are served unauthenticated on :8082, reachable only from
+## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
+
+## Setting METRICS_FQDN also adds a public metrics endpoint (behind
+## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
@@ -232,3 +236,6 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

MAINTENANCE.md

@@ -29,3 +29,4 @@ Everyone can apply to be a recipe maintainer:
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
+4. Join the room [#cc-|-traefik-maintenance:matrix.org](#cc-|-traefik-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -80,3 +80,19 @@ If you want to collect Prometheus metrics for Anubis, for instance with
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v32
-export FILE_PROVIDER_YML_VERSION=v12
+export TRAEFIK_YML_VERSION=v35
+export FILE_PROVIDER_YML_VERSION=v13
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.access-log.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:

compose.metrics.yml

@@ -3,3 +3,9 @@ services:
   app:
     environment:
       - METRICS_ENABLED
+    deploy:
+      labels:
+        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
+        # via the proxy network.
+        - "prometheus.io/scrape=true"
+        - "prometheus.io/port=8082"

file-provider.yml.tmpl

@@ -32,6 +32,7 @@ http:
         stsSeconds: "31536000"
   {{ if eq (env "METRICS_ENABLED") "1" }}
   routers:
+    {{ if ne (env "METRICS_FQDN") "" }}
     traefik-metrics:
       rule: "Host(`{{ env "METRICS_FQDN" }}`)"
       entrypoints:
@@ -41,6 +42,14 @@ http:
       middlewares:
         - basicauth@file
       service: prometheus@internal
+    {{ end }}
+    # reachable from other services on the proxy network only (this port
+    # isn't published to the host), without auth
+    traefik-metrics-internal:
+      rule: "PathPrefix(`/`)"
+      entrypoints:
+        - metrics-internal
+      service: prometheus@internal
   {{ end }}
 
 tls:

release/next

@@ -0,0 +1 @@
+1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.

traefik.yml.tmpl

@@ -6,6 +6,21 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -112,6 +127,10 @@ entrypoints:
   onion:
     address: ":9052"
   {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
+  metrics-internal:
+    address: ":8082"
+  {{- end }}
 
 ping:
   entryPoint: web